{"id":"ASB-A-496407345", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-04T16:48:29.960526221Z", "aliases":["CVE-2026-43499", "A-496407345"], "details":"In remove_waiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7", "https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6", "https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f", "https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"321623487731059697462659176703519390621", "length":753}, "id":"ASB-A-496407345-110d7f34", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6", "target":{"file":"kernel/locking/rtmutex.c", "function":"remove_waiter"}}, {"deprecated":false, "digest":{"line_hashes":["98042712526789370733806478659557162825", "126676874583107820258592533601385840698", "19642359851191854621195812806741186124", "14609262171748844005021633772876798503"], "threshold":0.9}, "id":"ASB-A-496407345-22c319b3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7", "target":{"file":"kernel/locking/rtmutex_api.c"}}, {"deprecated":false, "digest":{"function_hash":"8865747388681679273238240347913336704", "length":348}, "id":"ASB-A-496407345-393a44ac", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7", "target":{"file":"kernel/locking/rtmutex_api.c", "function":"rt_mutex_start_proxy_lock"}}, {"deprecated":false, "digest":{"function_hash":"121474958323146197188754889206337478448", "length":261}, "id":"ASB-A-496407345-751e280f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f", "target":{"file":"kernel/locking/rtmutex_api.c", "function":"rt_mutex_start_proxy_lock"}}, {"deprecated":false, "digest":{"function_hash":"321623487731059697462659176703519390621", "length":753}, "id":"ASB-A-496407345-7c808baf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1", "target":{"file":"kernel/locking/rtmutex.c", "function":"remove_waiter"}}, {"deprecated":false, "digest":{"line_hashes":["84269936625604621200357597489841864462", "72332967552365167678396858751267270359", "123144722431976731585365432604424527191", "53371536021202348677362757505832586433", "307527933472384961818192845659133641107", "203245035530162826384709227839934427850", "75116793936665624820930136254857920437", "256177438596760873311434396465664240989", "27332636958692321789847883230970156358", "9618425157490490837031240458221865987", "96231594927069690110890544437447439402", "71297725183417811193672019410092583209", "209604960097474086482785295245154164400", "140010148176648859616308240417706375647", "161362430862471991036898901121823974006", "209761725319832223996862197605802485380", "1831840297024962081632188923952264414", "302421641651323288913677140077751470820"], "threshold":0.9}, "id":"ASB-A-496407345-9610b5e9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6", "target":{"file":"kernel/locking/rtmutex.c"}}, {"deprecated":false, "digest":{"line_hashes":["84269936625604621200357597489841864462", "72332967552365167678396858751267270359", "123144722431976731585365432604424527191", "53371536021202348677362757505832586433", "307527933472384961818192845659133641107", "203245035530162826384709227839934427850", "75116793936665624820930136254857920437", "256177438596760873311434396465664240989", "27332636958692321789847883230970156358", "9618425157490490837031240458221865987", "96231594927069690110890544437447439402", "71297725183417811193672019410092583209", "209604960097474086482785295245154164400", "140010148176648859616308240417706375647", "161362430862471991036898901121823974006", "209761725319832223996862197605802485380", "1831840297024962081632188923952264414", "302421641651323288913677140077751470820"], "threshold":0.9}, "id":"ASB-A-496407345-de29bd9c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1", "target":{"file":"kernel/locking/rtmutex.c"}}, {"deprecated":false, "digest":{"line_hashes":["128606081143331584820015410938333341431", "59503128719007975942250479901900872536", "253704620930610164433288176540467167698", "59439083731474349844524076548377312763"], "threshold":0.9}, "id":"ASB-A-496407345-f92f72fd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f", "target":{"file":"kernel/locking/rtmutex_api.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/5339d13d8b945cd5841d0e70728ee67474ea74f7"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/e7d9bd94fbdbf9842ea6f1b6d5af45758e87e3d6"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/63493728373acb0b79eb6c94cf462cece1d8110f"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/eb88e44c4e7ac2f5a13b2b51b9dfa2aea677e3e1"}]}